Preparing for the App Store review

At a glance: Starting December 8, 2020, app developers must provide the App Store information related to their Privacy Practices when they submit an app. The App Store publishes the practices in the format of a nutrition label 

A word from our lawyers: Nothing stated here is legal advice. It is provided for your information and convenience. You should work closely with legal and other professional advisors to determine exactly how Apple policies apply to you. The privacy relationship between you and AppsFlyer is governed by the AppsFlyer Services Privacy Policy.

Nutrition labels and the App Store review

  • In order to generate the privacy labels, app developers need to answer a questionnaire when submitting their app to App Store Connect that includes the following sections:
  • App developers:
    • Have full control over how to implement and configure the AppsFlyer software, what data to collect, and how the data is used.
    • May have very different answers to the questionnaire based on how they configure the AppsFlyer software and the data points they choose to collect.
  • According to AppsFlyer understanding of the Apple guidelines, AppsFlyer software performs attribution; it does not perform tracking. That said, App developers need to respond to the questionnaire in accordance with their specific uses and partner integrations.  
  • The following charts assume the default configurations of the AppsFlyer software. App developers are responsible for ensuring they adapt accordingly in line with their specific configurations and uses. 

Data types collected

Data type

AppsFlyer data collection 

Remarks

Contact information

  • Name
  • Email address (including hashed)
  • Phone number (including hashed)
  • Physical address
  • Other user contact info 

No

Contact information should not be collected. However, if you have configured your app to transmit hashed emails or hashed phone numbers, respond accordingly in the App Store questionnaire.

Health and fitness

  • Health
  • Fitness

No

Don't collect

Financial info

  • Payment info
  • Credit info
  • Other financial info

No

Don't collect

Location info

  • Precise location
  • Coarse location

No

Don't collect

Sensitive info

No

Don't collect

Contacts

No

Don't collect

User content

  • Emails or text messages
  • Photos or videos
  • Audio data
  • Gameplay content
  • Customer support
  • Other user content

No

Don't collect

Browsing history

No

Don't collect

Search history

No

Don't collect

Identifiers

  • User ID
  • Device ID (IDFA)

Optional

  • User ID: App developers may set and transmit user ID (CUID) 
  • Device ID: The Advertising ID (IDFA) is collected only when accessible.

Purchases

  • Purchase history

Optional

App developers may choose to configure certain in-app purchase events to measure.

Usage data

  • Product interaction
  • Advertising data
  • Other usage data (for example, Wi-Fi)

  • Yes
  • Optional
  • Optional
  • Product interactions: App launches are measured, as well as any other user interaction configured by the app developer.
  • Advertising data: is received if the app developer uses the AppsFlyer ad revenue module.

Diagnostics data

  • Crash data
  • Performance data
  • Other diagnostics data

 

  • No 
  • Yes
  • No

Launch time and/or battery levels may be received for fraud detection.

Other data 


  • Other data types
  • IDFV

Yes

  • Technical device information (for example, OS, device type, language, Wi-Fi status, screen size,  etc.) or network information (for example, IP address, HTTP user agent) is received by AppsFlyer.
  • AppsFlyer applies an install ID to each app install called the AF ID.
  • IDFV is collected

Data use purposes

Apple has a list of purposes from which app developers need to choose, as detailed in the table that follows. You need to identify the relevant purposes for each data type related to your specific use.

Data purpose

Selection based on how data from AppsFlyer will be used

Third-party advertising

Select if you share the data type with a third party for the purpose of displaying third-party ads in your app.

Developer’s advertising or marketing

Select if you use to display first-party ads in your app (including if sharing with a third party to display your ads) or for other marketing purposes.

Analytics

Yes 

Product personalization

Select if you use data for any product personalization.

App functionality

Yes

Other purposes 

Select if you use the data for any purpose not otherwise stated.

Data linked to an identity

Data types collected through AppsFlyer are typically connected to an identifier like device ID (when available), or other identifiers like customer-issued IDs when configured.  

Therefore, app developers should select Yes when asked if the data is linked to an identity.

Legacy information

Legacy information provided thru November 5, 2020

iOS 14 implications updated prior to November 5, 2020. 

  • This article is updated based on the App Store review guidelines dated September 11, 2020. 
  • Starting with the release of iOS 14 until early 2021, the Grace Period, access to IDFA remains unchanged and you don't have to implement ATT.
  • As of September 16, 2020, AppsFlyer SDK versions are tested and are compatible with iOS 14. 
    • SDK V6.0.X
      • Attribution continues to operate unchanged compared to iOS 13. 
      • During the Grace Period:
        • Implement the AppsFlyer SKAdNetwork Solution.
        • Ensure that your ad network partners have SKAdNetwork integration with AppsFlyer.
        • Use AppsFlyer SKAdNetwork simulation to get a better understanding of how ATT will impact your attribution.
        • There is no need to display the ATT prompt. 
        • We may need to make further changes to the SDK to support changes to iOS at the end of the Grace Period. 
    • iOS SDK V5.4:
      • Attribution continues to operate unchanged compared to iOS 13. 
      • During the Grace Period consider adopting SDK V6.0.X and following the guidance above.
    • iOS SDK 4.9-5.3: 
      • Limited compatibility testing was performed and the outcome is similar to that of V5.4.
      • We do not support these versions in the context of iOS 14. 
Guide to App Store review starting iOS 14 using information available on September 11, 2020

Apple requirement

Guidance

Is the app available in the kids section of the App Store?

Disable the SDK from collecting IDFA. Use the following API calls to do so:

    • iOS SDK: disableAdvertisingIdentifier and disableCollectASA
    • Unity SDK:setDisableCollectIAD

Additional information: Kids Category

Do you want to collect IDFA? 

Implement iOS App Tracking Transparency (ATT) to enable the SDK to get IDFA. 

Do you want to collect IDFV?

IDFV is available to the SDK and can be used for analytics across apps from the same app owner.

Do you need to check the limit as tracking (LAT) setting?

No. Starting iOS 14, LAT is deprecated. 

Guide until iOS 13

Guide to App Store Connect review questions until iOS 13

App store question

What does the AppsFlyer SDK do?

Is the app available in the kids section of the App Store.

This table is not relevant and should not be used to answer questions relating to the kids section. 

Does this app use the Advertising Identifier (IDFA)?

AppsFlyer makes use of IDFA for attribution.

Serve advertisements within the app?

If ads are served, the AppsFlyer SDK may report the IDFA to AppsFlyer similarly to the data sent to AppsFlyer as part of in-app events.

Are you Attributing this app installation to a previously served advertisement?

 

AppsFlyer uses the IDFA to attribute installs.

Are you attributing an action taken within this app to a previously served advertisement?

AppsFlyer uses the IDFA to report actions in the app.

Is there a Limit Ad Tracking setting (LAT) in iOS?

Starting iOS 14 LAT is deprecated.

Ensure that your code complies with the requirement to honor the LAT setting.

AppsFlyer fully complies with the following requirement by Apple: "Check the value of this property before performing any advertising tracking. If the value is NO, use the advertising identifier only for the following purposes: frequency capping, conversion events, estimating the number of unique users, security and fraud detection, and debugging."

Additional information

  • The data is owned by our clients, the app owners. 
  • Your media partners might have different uses for the IDFA. Ensure that your media partners fully comply with Apple's requirements.
  • We enable you to comply with opt-out regulations, like GDPR, CCPA, and COPPA.
Was this article helpful?